EU Clinical Trials

Latham & Watkins - General Data Protection Regulation (GDPR)

The United Kingdom (the “UK”) left the European Union on 31 January 2020 and the Brexit transition period (during which EU law continued to apply directly in the UK) ended on 31 December 2020. From 1 January 2021, the General Data Protection Regulation (“GDPR”) will form part of UK domestic law as “retained EU law” as a result of the EU (Withdrawal) Act 2018 (and is referred to as the “UK GDPR”). The Data Protection Act 2018 (the “DPA”) supplements the UK GDPR.

The key authorities overseeing clinical research in the UK are:

The Medicines and Healthcare Products Regulatory Authority (the “MHRA”) regulates medicines, medical devices and blood components for transfusion in the UK and oversees clinical trials. You can find their website here.
The Health Research Authority (the “HRA”) works to protect and promote the interests of patients and the public in health research. You can find their website here.
Ethics Committees. Clinical trials for which ethics committee consent is required may only be initiated if consent is granted by the competent authority and a competent ethics committee. For a list of ethics committees in the UK, please see here.

This tool by the Medical Research Council and the HRA shows whether a given study requires ethics committee approval.

Clinical Trials Framework

The UK’s data protection regulator is the Information Commissioner’s Office. You can find their website here.

Legal basis for processing trial subjects' personal data

There is not a legally mandated legal basis that a sponsor of clinical trials must in all cases use to process trial subjects’ personal data. The entire set of legal bases under Articles 6 and 9 UK GDPR are available in principle and the most appropriate legal basis should be selected on a case by case basis. When processing special categories of personal data, including health and genetic data of trial participants, sponsors of clinical trials in the UK may wish to rely on the following legal bases, among others:

Public interest in the area of public health (Article 9(2)(i) UK GDPR); and
Scientific research (Article 9(2)(j) UK GDPR).

The scientific research basis (Article 9(2)(j) UK GDPR) for the processing of health data is available in the UK so long as certain conditions set out in the DPA are met. The processing needs to be:

necessary for the scientific research purpose being pursued;
subject to appropriate safeguards; and
in the public interest

Legal Basis

Public interest in the area of public health (Article 9(2)(i) UK GDPR); and
Scientific research (Article 9(2)(j) UK GDPR).

The scientific research basis (Article 9(2)(j) UK GDPR) for the processing of health data is available in the UK so long as certain conditions set out in the DPA are met. The processing needs to be:

necessary for the scientific research purpose being pursued;
subject to appropriate safeguards; and
in the public interest

Relationship Between Sponsor and Site

The GDPR and UK law distinguish between data controllers (i.e., organisations that determine the purposes and the means for processing personal data) and data processors (i.e., organisations that process personal data on the instructions of a data controller).

In the UK:

The sponsor is considered a data controller in relation to personal data collected from trial subjects;
The clinical site is considered a data processor for the purposes of the research (e.g., when completing case report form) but a data controller in its own right for the data that it holds for the purposes of providing care to the patient; and
The clinical research organization (“CRO”), if one is used, is considered a data processor for the data controller with respect to any personal data they hold in connection with the research. In certain cases, the CRO may be a joint controller if it makes certain decisions about the purposes and the means for processing.

Additional Resources

Informed Consent Form and Participant Information Guidance published by the HRA containing principles of informed consent for participation in a study and recommended content of a Patient Information Sheet and consent form.

GDPR Transparency Wording for inclusion in a Patient Information Sheet published by the HRA.

The Clinical Trial Agreement and Clinical Research Organisation Model Clinical Trial Agreement published by the Department of Health. These are templates designed to be used without modification for industry-sponsored trials in NHS patients in hospitals in the UK. The accompanying guidance notes provide background. Use is not mandatory but is strongly recommended.